Malicious PDF — malware analysis report

Static analysis result for SHA-256 55c5cd0d0e6426e5…

MALICIOUS

PDF

88.8 KB Created: 2021-03-16 23:12:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f3e6137834ae1b90d8005887a255de79 SHA-1: 345110bc81c72a0d19ffd04328d6a129fcd6d003 SHA-256: 55c5cd0d0e6426e5795d5dadfac3849ec964238701a6b970573b6f6e83ab9a9d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. The embedded URL `https://botokaw.ru/123?utm_term=catapult+king+apk` suggests a lure to download an application, likely malicious. The document structure and embedded URLs indicate an attempt to trick the user into downloading a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/123?utm_term=catapult+king+apk
    • https://static.s123-cdn-static.com/uploads/4470687/normal_5ffb4ed82893a.pdf
    • https://cdn-cms.f-static.net/uploads/4491152/normal_60486b7427345.pdf
    • https://cdn-cms.f-static.net/uploads/4378404/normal_603079aa9855f.pdf
    • http://zuregazezoral.mygamesonline.org/kozagufe.pdf
    • https://cdn-cms.f-static.net/uploads/4447433/normal_5fd3504500f15.pdf
    • https://cdn-cms.f-static.net/uploads/4481671/normal_6039ea7d6850d.pdf
    • http://nejevefivi.mypressonline.com/70341032830.pdf
    • https://cdn-cms.f-static.net/uploads/4450148/normal_6019025b52bf8.pdf
    • https://cdn-cms.f-static.net/uploads/4378605/normal_5fd7e61caaa7a.pdf
    • https://cdn-cms.f-static.net/uploads/4471996/normal_601b34d180fa2.pdf
    • http://wapadax.scienceontheweb.net/risedibulibezepetifeto.pdf
    • https://static.s123-cdn-static.com/uploads/4451551/normal_5ff6a671b4891.pdf
    • http://jakiduve.scienceontheweb.net/32483001142.pdf
    • https://cdn-cms.f-static.net/uploads/4376101/normal_601b1c734d386.pdf
    • https://cdn-cms.f-static.net/uploads/4410954/normal_601b4d06f37c5.pdf
    • http://minecra
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://zeluzara.epizy.com/xuwegasegowejilunuk.pdf
    • http://gufusogatodogej.rf.gd/android_mobile_update_app.pdf
    • http://dinimonubikajo.rf.gd/appium_set_android_home.pdf
    • https://uploads.strikinglycdn.com/files/e002e92c-d06d-4836-ab90-d87e55516ab8/why_finland_has_the_best_education_in_the_world.pdf
    • https://uploads.strikinglycdn.com/files/844b4d24-e0dd-4083-9ce7-dc755ba4f8f5/arifureta_shokugyou_de_sekai_saikyou_light_novel_volume_3_illustrations.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f0cb.bin
672a849737ffe803c85ce41cc16b63f4b29df71d6c44bcd3bfc8f0a193e32027		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF0CB 4684 bytes
font_01_sfnt_off000100c7.bin
70cc9ab87f19129d0ed3cbf9a157aac9c539a57504ade66176bcc46f86b9f1b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100C7 5816 bytes
font_02_sfnt_off000114ad.bin
52016f601cec6cc60342fe6046975c464322ca3067d462ee47faf1fdf394f9c2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x114AD 13232 bytes
font_03_sfnt_off00014032.bin
f81f55da2362c55bd466477680eabf40fcf343a541a08b66643f24abe242ff69		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14032 16256 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.